Changelog

Notable user-facing changes per release. Install the latest with curl -fsSL https://dl.shipmoor.dev/install.sh | bash, or update in place with shipmoor upgrade.

0.6.0, 2026-06-30

The advisory Code Review surface ships in the shipmoor binary, and the Agent Harness and the IDE Extension are both fully generally available on the stable channel.

Shipmoor Code Review (new)

shipmoor review is an advisory AI code reviewer. You bring your own agent with --agent (the built-in claude and codex presets drive those CLIs for you, or pass any command that speaks the stdin/stdout wire contract). It runs locally, hosts no model, and uploads no source. It is gated on the cli_pro entitlement. See the Quickstart.
Advisory, never gates. Review output is the same shipmoor.scan.v1 and SARIF 2.1.0 you already consume, stamped with category: "code_review" and rule_id: "shipmoor.review.llm". That category is excluded from the shipmoor scan --fail-on gate by construction, so a review finding at any severity contributes zero to pass or fail and shipmoor review never returns the gating exit code 1. See the CLI reference.
Editor and CI surfaces. The IDE renders review findings as advisory Information diagnostics in a separate collection, excluded from your problem counts (see IDE). The reference CI design posts advisory PR comments through a hardened split workflow so a fork PR can never combine source checkout with your agent’s key (see CI integration).

IDE Extension v0.4.0, 2026-06-30

The IDE Extension reaches general availability on the VS Code Marketplace and Open VSX, and adds the advisory Code Review commands. (The IDE extension ships on its own version track, separate from the shipmoor CLI versions below.)

Advisory review in the editor

Two Advisory Review commands (Changed Files and Current File) shell shipmoor review and render its findings as Information-level diagnostics in a separate shipmoor-review collection with the source Shipmoor (advisory). They are kept out of the status-bar problem count, so the count stays an honest tally of structural issues. The commands appear only when cli_pro is active or in grace. See IDE.

IDE Extension v0.3.0, 2026-06-27

The IDE Extension is published to the VS Code Marketplace and Open VSX with its agent and Claim Check editor layers. They switch on automatically for plans that already carry the matching entitlement; there is no new tier. (The IDE extension ships on its own version track, separate from the shipmoor CLI versions below.)

Agent-aware diagnostics

Findings attributed to an agent edit get an amber gutter badge and a Send this finding back to the agent action that posts a metadata-only payload (never your source) to the Agent Harness inbox. Nested on agent_harness.

Claim Check in the editor

Claim Check findings get a distinct decoration, and Set Intent / Clear Intent record the task the current change should satisfy (kept in editor workspace state only, never transmitted). Nested on intent_scan.

0.5.1, 2026-06-27

A polish release for the Agent Harness and the scanner. No change to the scan JSON wire shape; output you already consume is unaffected.

Native Cursor adapter

shipmoor harness install cursor now writes a real .cursor/hooks.json, wired to shipmoor harness hook cursor stop and the after-file-edit event, so the harness runs natively inside Cursor, at parity with the Claude Code adapter. Pass --soft to keep the previous rules-only fallback instead of the native hooks. See With Cursor.

One-shot harness scan

shipmoor harness scan runs a single scan pass and exits, built for hook invocations and CI steps that want one harness-shaped result rather than a long-running watch session.

Dev- and test-aware scanning

Test tooling imported only in test files (for example pytest) is no longer flagged as a phantom import. The scanner recognizes dev/test context, so test-only dependencies stop producing false blockers.

Canonical scan schema

The scan.v1 finding shape is now published as a single canonical schema shared across the CLI, the IDE Extension, and the harness, so every surface reads the same contract. This is a hygiene change only; the JSON Shipmoor emits is byte-for-byte the same as 0.5.0. See Contracts & schemas.

0.5.0, 2026-06-24

The Agent Harness is now generally available, bundled inside the shipmoor binary and invoked as shipmoor harness <command>. This also fixes the earlier “harness not found” problem where the harness was packaged separately and never installed alongside the CLI.

Agent Harness (GA)

shipmoor harness <command>: the Agent Harness (status, mode, install, uninstall, codex, watch, hook, inbox) ships in the shipmoor binary. There is no separate package to install; if you have the CLI, you have the harness. It is generally available on the IC plan via the agent_harness entitlement. It was a preview through 0.4.x; the commands and behavior documented under Agent Harness are now stable.
Per-agent adapters write native config: install configures each agent the way that agent expects: Claude Code gets hooks in .claude/settings.json, Codex gets guidance in AGENTS.md, and Cursor gets rules. Reinstalling migrates older standalone shipmoor-harness … hook entries automatically.

The old standalone shipmoor-harness script is recognized as a legacy alias on reinstall, but the supported entry point is now shipmoor harness <command>.

0.4.0, 2026-06-10

Additive to the shipped scan and claim-check contracts, with no behavior change for existing users.

New: Agent Skills

shipmoor skills {list,install,uninstall,status}: installs the Shipmoor skill bundle into your coding agent’s instruction files (Claude Code, Codex, Cursor, Aider). Installs are marker-wrapped, idempotent, and content-preserving; uninstall removes only the managed block.
Five skills ship in the bundle: shipmoor-review, shipmoor-intent-contract, shipmoor-fix, shipmoor-agent-guard, and shipmoor-pr-preflight. Gated by the new agent_skills entitlement on the IC plan; without it, list/status show the catalog and install points at the DIY Community path.

New: BYO-Judge

scan --intent … --agent "<cmd>": the claim check can hand the masked change signal to your own coding agent (e.g. a headless claude -p) for an advisory opinion on changes no deterministic probe covers. Advisory only, it can never block, with declared judge isolation (--author-model-id, --strict-judge-isolation). See BYO-Judge.

Claim Check improvements

Dispatch-table style webhook handlers are no longer incorrectly flagged as failing the handler-binding probe.
The BYO-Judge opt-in and its non-low-confidence requirement are now documented behavior. See Providing intent.

Reliability fixes

shipmoor upgrade works on macOS: upgrades no longer abort with “archive contains an unsafe link” (safe in-bundle symlinks are now allowed; escaping links are still blocked).
HTTPS is self-contained: login, upgrade, and license refresh ship their own CA roots, so they work regardless of the host’s OpenSSL configuration.
scan --output now creates the parent directory on a fresh repo instead of erroring.
License verification hardening: a build-time guard ensures shipped binaries always carry the production signing keyset.

Also in this release

A staging install channel for early validation: SHIPMOOR_CHANNEL=staging curl -fsSL https://dl.shipmoor.dev/install.sh | bash.
The Agent Harness foundation (scanner, orchestrator, install/status, entitlement gating) landed; it became generally available in 0.5.0.

0.3.0, 2026-06-07

The first entitlement-aware release: one universal binary for every tier, with paid features unlocked by a local license. Community scan, JSON/SARIF, and exit-code behavior unchanged.

Sign-in and licensing: device-flow login, offline Ed25519 license verification, whoami --json and capabilities --json (the entitlement contract), and shipmoor upgrade for in-place self-update.
Claim Check: the canonical scan --intent (quickstart): deterministic probes, maturity & coverage, the opt-in deterministic gate, plan-drift probes, and agent-session ingestion (--session, masked on ingest).

0.2.x, 2026-05/06 · Community CLI

The free Community line: the redesigned five-second scan output (0.2.1); monorepo manifest resolution, Go phantom-import detection with subtypes, the cross-language severity policy, and finding-level remediation text (0.2.0). Launch details in the blog.

CLI reference: every command and flag, including shipmoor harness.
Security & privacy: what stays local and what crosses the wire.